Deobfuscate/Decode Files or Information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware, Scripting, PowerShell, or by using utilities present on the system.

One such example is use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. ^[1]

Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. ^[2]

Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used with Obfuscated Files or Information during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ^[3] Adversaries may also used compressed or archived scripts, such as Javascript.

ID: T1140

Tactic: Defense Evasion

Platform: Windows

Permissions Required: User

Data Sources: File monitoring, Process monitoring, Process command-line parameters

Defense Bypassed: Anti-virus, Host intrusion prevention systems, Signature-based detection, Network intrusion detection system

Contributors: Matthew Demaske, Adaptforward; Red Canary

Version: 1.0

Examples

Name	Description
APT19	An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.^[4]
APT28	An APT28 macro uses the command `certutil -decode` to decode contents of a .txt file storing the base64 encoded payload.^[5]^[6]
Astaroth	Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.^[7]
AuditCred	AuditCred uses XOR and RC4 to perform decryption on the code functions.^[8]
Azorult	Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.^[9]^[10]
Bankshot	Bankshot decodes embedded XOR strings.^[11]
BBSRAT	BBSRAT uses Expand to decompress a CAB file into executable content.^[12]
Bisonal	Bisonal decodes strings in the malware using XOR and RC4.^[13]
BRONZE BUTLER	BRONZE BUTLER downloads encoded payloads and decodes them on the victim.^[14]
Carbon	Carbon decrypts task and configuration files for execution.^[15]
Cardinal RAT	Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.^[16]
certutil	certutil has been used to decode binaries hidden inside certificate files as Base64 information.^[1]
CoinTicker	CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.^[17]
Darkhotel	Darkhotel has decrypted strings and imports using RC4 during execution.^[18]
DDKONG	DDKONG decodes an embedded configuration using XOR.^[19]
Denis	Denis will decrypt important strings used for C&C communication.^[20]
Dyre	Dyre decrypts resources needed for targeting the victim.^[21]
Expand	Expand can be used to decompress a local or remote CAB file into an executable.^[22]
Final1stspy	Final1stspy uses Python code to deobfuscate base64-encoded strings.^[23]
FinFisher	FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.^[24]^[25]
Gorgon Group	Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.^[26]
Honeybee	Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.^[27]
InvisiMole	InvisiMole can decrypt, unpack and load a DLL from its resources.^[28]
ISMInjector	ISMInjector uses the `certutil` command to decode a payload file.^[29]
Kwampirs	Kwampirs decrypts and extracts a copy of its main DLL payload when executing.^[30]
Leviathan	Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.^[31]
menuPass	menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has used `certutil -decode` to decode files on the victim’s machine when dropping UPPERCUT.^[32]^[33]
MirageFox	MirageFox has a function for decrypting data containing C2 configuration information.^[34]
MuddyWater	MuddyWater decoded base64-encoded PowerShell commands using a VBS file.^[35]^[36]^[37]
NOKKI	NOKKI uses a unique, custom de-obfuscation technique.^[38]
OilRig	A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.^[39]^[29]^[40]
OopsIE	OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.^[40]
PlugX	PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.^[41]
POWERSTATS	POWERSTATS can deobfuscate the main backdoor code.^[37]
Proton	Proton uses an encrypted file to store commands and configuration values.^[42]
QUADAGENT	QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.^[43]
Remexi	Remexi decrypts the configuration data using XOR with 25-character keys.^[44]
RGDoor	RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.^[45]
RogueRobin	RogueRobin decodes an embedded executable using base64 and decompresses it.^[46]
Smoke Loader	Smoke Loader deobfuscates its code.^[47]
Starloader	Starloader decrypts and executes shellcode from a file called Stars.jps.^[48]
Threat Group-3390	During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^[49]
TrickBot	TrickBot decodes the configuration data and modules.^[50]
Tropic Trooper	Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.^[51]
TYPEFRAME	One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".^[52]
VERMIN	VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.^[53]
Volgmer	Volgmer deobfuscates its strings and APIs once its executed.^[54]
Zebrocy	Zebrocy decodes its secondary payload and writes it to the victim’s machine.Zebrocy uses AES and XOR to decrypt strings and payloads.^[55]^[56]
ZeroT	ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.^[57]
Zeus Panda	Zeus Panda decrypts strings in the code during the execution process.^[58]

Mitigation

Identify unnecessary system utilities or potentially malicious software that may be used to deobfuscate or decode files or information, and audit and/or block them by using whitelisting ^[59] tools, like AppLocker, ^[60] ^[61] or Software Restriction Policies ^[62] where appropriate. ^[63]

Detection

Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as certutil.

Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.

Deobfuscate/Decode Files or Information

Examples

Mitigation

Detection

References